Remove secret keys from all documentation and code.

[rohit-joy]

Some secret keys hardcoded were flagged in security scans. Please remove all of them.

Recommendations:

1. In Tests, generate the keys at runtime.

2. In Documentation, leave a small excerpt or placeholder indicating what key should go where.

3. In product/service runtime, get the keys from a secret store. Kubernetes has drivers that can read and fill mount points inside of Pods with secrets from a secret store.

[excelsior]

@rohit-joy

I fixed most of the vulnerabilities, except these:

• Row 7:

{
  "file"=>"C:/Users/Public/Fortify/SC/jobs/575d502a-25a0-466d-b5aa-62eca7607efa/work/Src/credentialregistry/Dockerfile copy",
  "start_line"=>26
}

There's no such file in the repository.

• Rows 10 & 13:

Attackers can control the file system path argument to open() at jwt_encode.py line 9, which allows them to access or modify otherwise protected files.

The whole purpose of that script is to read a file from the path specified by the user and generate a token from it. The script can't be called from the outside and the file's content isn't exposed in any way.

What's the best way to fix it?

• Row 11:

{
  "file"=>"C:/Users/Public/Fortify/SC/jobs/575d502a-25a0-466d-b5aa-62eca7607efa/work/Src/credentialregistry/db/seeds/envelope.json",
  "start_line"=>6
}

There's no such file in the repository anymore.

[rohit-joy]

Row 7: Ignore

Row 10 and 13: Move that into the markdown documentation instead of leaving it as a py file.

Row 11: Ignore

Thank you, @excelsior .

[excelsior]

@rohit-joy All the violations have been addressed and both repos contain the necessary changes.

[jeannekitchens]

@rohit-joy can this be closed? If not, identify all open items.